Impacts of GPS Spoofing on Path Planning of Unmanned Surface Ships

Abstract

The Artificial Potential Field (APF) method is a classical path planning method for unmanned ships, relying on Global Positioning System (GPS) positioning information for path planning. Unfortunately, once the path planning algorithm uses inaccurate or even fake data, it will lead to ship collision, grounding, or deviation from the course, causing severe economic losses and causing significant security risks to other sailing ships. This paper aims to study the impacts of GPS spoofing on the path planning of unmanned ships. We propose a GPS attack and study GPS spoofing of path planning based on the APF method for an unmanned ship by a low-cost software-defined radio, which causes the unmanned ship to deviate from the course. Our simulation tests show that this method has significant impacts on the path planning results of the APF method.

1. Introduction

Unmanned Surface Vehicles (USVs) are ships that operate on the water surface without a crew [1,2]. USVs have great advantages, including efficiency, cost-effectiveness, environmental friendliness, work safety, and family friendliness [3]. USVs navigate in complex water areas, including islands, shoals, reefs, and other obstacles [4]. Path planning for USVs is an important guarantee for safe navigation of USVs [5]. There are some path planning algorithms for USVs, including Artificial Potential Field (APF), A* algorithm, Ant Colony Algorithm (ACA), etc. [6,7]. The APF method is a classical path planning algorithm, which can plan a smooth and safe path for vehicle travel on the sea where both static and dynamic obstacles exist. We believe that this paper’s studies can also be applied to other methods in the field. Its core idea is to assume that an unmanned ship moves and is controlled by a resultant force under two virtual forces: a target point has “gravity” on the unmanned ship, and some obstacles have “repulsive force” on the unmanned ship [8,9]. Since this method has the problem of local optimum, many researchers have improved it [10,11,12,13,14]. The traditional APF method usually needs to calculate the resultant force of gravitational and repulsive forces on the ship according to the speed of its own ship, real-time position, and goal position. The improved APF method calculates the steering angle and heading based on its own ship’s position, target ship’s position, ship’s speed, target ships’ speed, ship’s heading, and target ships’ heading to avoid collision with dynamic ships. These data are obtained by Automatic Identification System (AIS), Global Positioning System (GPS), speed log, compass, and radar. After data fusion and calculation, paths are finally planned for unmanned ships. The papers [15,16] have introduced these data collection and path planning algorithms in detail.

The path planning results of unmanned ships based on the APF method are affected by GPS position data [17]. Unfortunately, the structure of civil GPS signals is public, which brings hidden trouble to the application of the APF method in path planning for unmanned ships. If the signals’ strength is weak, the attackers do not need to produce strong false signals to cover the authentic signals [18]. At present, the frequencies of GPS signals can be generated by existing commercial equipment. If the GPS receiver receives these fictitious GPS signals instead of the real GPS signals, it will harm the path planning and collision avoidance algorithm of unmanned ships, resulting in yaw, grounding, and even collision. Once hackers or attackers attack the GPS and AIS data received by unmanned ships, the use of inaccurate or even wrong data in the APF path planning algorithm will lead to ship collision, grounding, or deviation from the course, causing severe economic losses and significant security risks to other sailing ships.

In a GPS spoofing attack system, an attacker induces a GPS receiver to lock and capture false GPS signals so that the GPS receiver calculates a wrong position. There are two main approaches to GPS spoofing attacks. The first one is that attackers interfere with GPS receivers to track authentic signals by transmitting jamming signals so that GPS receivers can track and capture false GPS signals. If the power of the spoofing signals is 4 dB stronger than the authentic signals, the normal tracking of the authentic signals can be interrupted within 50 min [19]. Meanwhile, GPS receivers are induced to recapture and track the spoofing signals. The second approach is that the signals generated by GPS spoofers are initially almost wholly aligned with the authentic signals and are kept below the noise with low power. Then the attackers gradually make the power of the spoofing signals slightly stronger than the power of the authentic signals, and finally, they make the GPS receivers track the false GPS signals.

There are many papers in the literature studying the APF methods. The authors in [20] present a structure of repulsion potential for APF, adding a rotational avoidance force, which can effectively reduce oscillations and avoid conflict when the target is near obstacles. The authors in [21] propose a modified APF method, which introduces virtual target points and changes the repulsion field function to solve the problem of unreachable target points and local extreme points to avoid obstacles in real-time. To make the target reach the goal, avoid obstacles, and avoid the target getting stuck in the local minimum, the authors in [22] propose an improved APF method by looking for an appropriate cost function.

There are many papers studying GPS spoofing. The authors in [23] describe a series of attack methods based on GPS spoofing in detail. The authors in [24] study attackers using civil or military GPS receivers to spoof victims and determine the GPS spoofing parameters, such as position and signal accuracy. There are also some examples of GPS attacks. For instance, in June 2021, GPS attacks made a warship of the U.K. near a Russian naval base by mistake [25]. This incident fully shows that GPS attacks have significant impacts on ship navigation safety.

Attacks are almost in every cyber or physical related field [26]. Our research interests focus on attacks on ships and the functions of ships. The motivation of this paper is to systematically study the path planning of unmanned ships impacted by the security of GPS, implement the practical applications, and promote the research of the network security of unmanned ships. The research on the influence of GPS spoofing on path planning of artificial potential fields is beneficial for unmanned shipbuilders, researchers, and students. The contributions of this paper are listed as follows:

• To the best of our knowledge, this is the first time the influence of GPS spoofing on the path planning of unmanned ships is researched using the artificial potential field method;
• We study the security of GPS and propose a GPS attack using a low-cost software-defined radio, which can cause deviations to the result of path planning based on the artificial potential field method, leading to path yaw. Our simulation results show that this method can influence the path planning results of the artificial potential field method;
• We study the feasibility of using low-cost and portable GPS spoofers to implement GPS spoofing and conduct a practical test.

The rest of this paper is organized as follows. Section 2 introduces the traditional and modified artificial potential field methods. Section 3 first describes the principle of GPS positioning and GPS spoofing attacks based on the APF method, and then proposes a feasible GPS spoofing attack scheme and analyzes the influence of GPS spoofing on the path planning results of unmanned ships based on the APF method. Section 4 presents experiments/simulations of a GPS spoofing attacker for the APF model of unmanned ships. Finally, we conclude this paper in Section 5.

2. Artificial Potential Field

2.1. Traditional Artificial Potential Field

The artificial Potential Field (APF) method is a virtual force method proposed by Khatib in 1986 [27]. In ship domain [28], let own ship (OS) denote the ship, which needs to use the APF method for path planning, and let TSs (target ships) denote the ships which are dynamic ships around the OS to be avoided. In the virtual potential field for ship path planning, obstacles are surrounded by repulsive potential fields to force the ship away, and attractive potential fields surround the goal to attract the ship, shown in Figure 1. Obstacles include dynamic TSs and static obstacles (i.e., island, rocky outcroppings, and shoals). The combined force on the ship is equal to the negative gradient of the total potential field. Under the combined force, the ship sails from a high potential field to a low potential field along the negative gradient direction, shown in Figure 2. $F_{att}$, $F_{rep}$, and F is an attractive force from the goal, a repulsive force function from the obstacle, and the combined force of attraction and repulsion, respectively. Therefore, the traditional APF method can effectively implement obstacle avoidance and path planning of ships. The core idea of the APF method is to find the potential functions under the combined potential of attraction and repulsion. These functions can be represented by the following Equations (1)–(10), based on [27]:

$$U\left(X\right)=U_{att}\left(X\right)+U_{rep}\left(X\right),$$

(1)

where $U\left(X\right)$, $U_{att}\left(X\right)$, and $U_{rep}\left(X\right)$ represent the artificial potential field, the attractive potential field, and the repulsive potential field, respectively; and X is the position of the OS. In addition, the attractive potential field $U_{att}\left(X\right)$ is written as

$$U_{att}\left(X\right)={\displaystyle \frac{1}{2}}\xi {\rho }^2(X,X_g),$$

(2)

where $\xi$ is a positive scaling factor for the attractive potential and $X_g$ is the position of the goal; $\rho (X,X_g)$ is the distance of the two locations where $\rho (X,X_g)=\parallel X-X_g\parallel =\sqrt{{(x-x_g)}^2+{(y-y_g)}^2}$, $X=(x,y)$, and $X_g=(x_g,y_g)$. We assume that there are $N(N\ge j)$ obstacles around the OS. Furthermore, the repulsive potential field of the jth obstacle ($o_j$) can be written as:

$$U_{re{p}_j}\left(X\right)=\left\{\begin{array}{ccc}\hfill {\displaystyle \frac{1}{2}}\eta {\left[{\displaystyle \frac{1}{\rho (X,X_{o_j})}}-{\displaystyle \frac{1}{{\rho }_0}}\right]}^2& & \hfill \rho (X,X_{o_j})\le {\rho }_0\\ \hfill 0& & \hfill \rho (X,X_{o_j})>{\rho }_0\end{array}\right.,$$

(3)

where $\eta$ is a positive scaling factor for repulsive potential, ${\rho }_0$ is the distance threshold for an obstacle to create a repulsion effect on the OS. The selection of the distance ${\rho }_0\ge V_{max}/2D_{max}$ will depend on the maximum speed ($V_{max}$) and the maximum deceleration ability of the OS ($D_{max}$). In a two-dimensional space, X = (x, y) is the coordinate of the OS, $X_{o_j}=(x_{o_j},y_{o_j})$ is the coordinate of the jth obstacle, and $\rho (X,X_{o_j})=\parallel X_{o_j}-X\parallel =\sqrt{{(x-x_{o_j})}^2+{(y-y_{o_j})}^2}$ is the Euclidean distance between the OS and the jth obstacle. The total repulsive potential field of obstacles is the sum of the repulsive potential fields produced by all obstacles to OS, written as:

$$U_{rep}=\sum _{j=1}^N{U}_{re{p}_j}\left(X\right),$$

(4)

where N is the total number of all obstacles. The goal puts an attraction on the OS, attracts OS to approach gradually, and finally arrives. The obstacles repulse OS to avoid collisions. The derivatives of the attractive potential function and the repulsive potential functions are an attractive force function and the repulsive force functions, respectively, written as

$$F_{att}\left(X\right)=-\nabla U_{att}\left(X\right),$$

(5)

$$\nabla U_{att}\left(X\right)=\xi (X-X_g),$$

(6)

$$F_{re{p}_j}\left(X\right)=-\nabla U_{re{p}_j}\left(X\right),$$

(7)

$$\nabla U_{re{p}_j}\left(X\right)=\left\{\begin{array}{ccc}\hfill \eta \left[{\displaystyle \frac{1}{\rho (X,X_{o_j})}}-{\displaystyle \frac{1}{\rho }}\right]{\displaystyle \frac{1}{{\rho }_0^2}}& & \hfill \rho (X,X_{o_j})\le {\rho }_0\\ \hfill 0& & \hfill \rho (X,X_{o_j})>{\rho }_0\end{array}\right.,$$

(8)

$$F_{rep}\left(X\right)=\sum _{j=1}^N{F}_{repi}\left(X\right),$$

(9)

where $\nabla U_{att}\left(X\right)$ and $\nabla U_{re{p}_j}\left(X\right)$ are the attractive gradient and the jth repulsive gradient function, respectively. $F_{att}\left(X\right)$ and $F_{re{p}_j}\left(X\right)$ are the attractive force and the jth repulsive force function, respectively. The sum of attraction and repulsion forces on the OS can be expressed simply as the sum of vectors:

$$F\left(X\right)=F_{att}\left(X\right)+F_{rep}\left(X\right).$$

(10)

2.2. Modified Artificial Potential Field (APF)

The traditional APF method has the advantages of simple calculation and effectivity. However, the traditional APF method has the problem of local minimum [29]. Meanwhile, APF for path planning of USV also needs to consider collision avoidance with dynamic TSs, static obstacles, and emergency. The authors [12] proposed a modified APF including the modified repulsion potential field function and the corresponding virtual force to solve the dynamic target collision avoidance. They subdivided the repulsive potential field function according to the requirements of International Regulations for Preventing Collisions at Sea (COLREGS), including dynamic TSs, static obstacles, emergencies, and others, which are shown in the equations based on [12]. This paper focuses on the introduction of APF for dynamic TSs, shown in Figure 3. We have

$$d_m=R_{os}+d_{safe}+R_{ts},$$

(11)

where $R_{ts}$ and $R_{os}$ are the ship domain radiuses of the OS and TS, respectively; $d_m$ is the sum of $R_{ts}$, $R_{os}$, and the safe distance between OS and TS ($d_{safe}$). We have

$${\theta }_m=arctan\left(\frac{d_m}{\sqrt{{\rho }^2(p_{os},p_{ts})-d_m^2}}\right),$$

(12)

where ${\theta }_m$ is the angle between the tangent line of the radius circle of $d_m$ and the vector of the OS to the TS. $p_{ts}$, $p_{os}$, and $p_g$ are the position of the OS, the Ts, and the goal. $\rho (p_{os},p_{ts})$ is the Euclidean distance between the OS and the TS. According to the above equations, the modified attractive and repulsive potential function are shown in Equations (13) and (14).

$$U_{att}\left(p\right)={\displaystyle \frac{1}{2}}\xi {\rho }^2(p_{os},p_g),$$

(13)

$$U_{rep}(d,\theta )=\left\{\begin{array}{cc}\hfill {\eta }_d{R}_{ts}{({\displaystyle \frac{1}{d-d_m}}-{\displaystyle \frac{1}{{\rho }_0}})}^2(e^{\theta {}_m-\theta }-1)d_g^2,& v_{ts}\ne 0,d_m<d\le CRand\theta <{\theta }_m\\ \hfill {\displaystyle \frac{1}{2}}{\eta }_s{R}_{ts}{({\displaystyle \frac{1}{d-\tau }}-{\displaystyle \frac{1}{{\rho }_0}})}^2{d}_g^2,& v_{ts}=0,d_m<d\le CRand\theta <{\theta }_m\\ \hfill {\eta }_e{R}_{ts}\left[{({\displaystyle \frac{1}{d-\tau }}-{\displaystyle \frac{1}{{\rho }_0}})}^2+(\parallel V_{to}{\parallel cos\theta )}^2\right]d_g^2,& d\le d_m\\ \hfill notdefined,& others\end{array}\right.,$$

(14)

where ${\rho }_0$ is the preset influence range of the TS and $\tau$ is the radius of an artificial safety margin of the OS. $v_{ts}$ and $v_{os}$ are the speeds of TS and OS, respectively. $\theta$ is the angle between the vector $p_{ot}$ ($p_{ts}-p_{os}$) and the relative speed vector $v_{t}o$ ($v_{os}-v_{ts}$), and $\parallel V_{to}\parallel =\sqrt{v_{os}^2-v_{ts}^2}$ is the relative speed vector from the OS to the TS. $d_g$ = $\rho (p_{os},p_g)$, CR is the sum of $d_m$ and ${\rho }_0$. ${\eta }_d$, ${\eta }_s$, and ${\eta }_e$ are the positive scaling factors for the dynamic the TSs, static obstacles, and emergency action, respectively. $F_{att}\left(p\right)$ is the attractive force in term of the position, shown in Equation (15). $F_{rep}(d,\theta )$ is repulsive force of the position and the velocities, shown in Equation (19).

$$F_{att}\left(p\right)=-\nabla \left[U_{att}\left(p\right)\right]=\xi \rho (p_{os},p_g),$$

(15)

$$F_{rd}=F_{rd1}+F_{rd2}+F_{rd3},$$

(16)

$$F_{rs}=F_{rs1}+F_{rs3},$$

(17)

$$F_{re}=F_{re1}+F_{re2}+F_{re3},$$

(18)

$$F_{rep}(d,\theta )=\left\{\begin{array}{cc}\hfill F_{rd},& v_{ts}\ne 0,d_m<d\le CRand\theta <{\theta }_m\\ \hfill F_{rs},& v_{ts}=0,d_m<d\le CRand\theta <{\theta }_m\\ \hfill F_{re},& d\le d_m\\ \hfill notdefined,& others\end{array}\right.,$$

(19)

where $F_{rd1}$ and $F_{rd3}$ are the repulsive force from the TS and the attractive force from the goal, respectively, when the obstacles are dynamic TSs. $F_{rd2}$ is the repulsive force to make the OS alter course to starboard for TS to meet COLREGS requirements. $F_{rs1}$ and $F_{rs3}$ are the repulsive force from the obstacle and the attractive force from the goal when the obstacles are static obstacles, respectively. For an emergency action, $F_{re1}$ and $F_{re3}$ are the repulsive force from the obstacles and the attractive force from the goal, respectively. $F_{re2}$ makes the OS avoid collisions from the right or the left side of $p_{ot}$ according to which side of the $p_{ot}$ line the vector $v_{to}$ is on. This modified APF calculates the steering angle ($\nabla {\psi }_{os}$), desired heading (${\psi }_{os}$), and dynamic position ($p_{os}$) by inputting $p_{ts}$, $p_{os}$, $p_g$, $v_{os}$, $v_{ts}$, $R_{os}$, $R_{ts}$, $d_{safe}$, ${\rho }_0$, ${\eta }_d$, ${\eta }_s$, and ${\eta }_e$.

3. GPS Attack Designs and Spoofing Analysis

In this section, we first introduce GPS and attacks on GPS. Then we design a GPS spoofing attack and analyze how the GPS spoofing influences the result of the path planning of unmanned ships based on the APF method in Section 2.

3.1. GPS Introduction

Global Positioning System (GPS) is a satellite navigation system, which provides position, navigation, and timing for land, sea, and air in the world [30]. Furthermore, a GPS is an important navigation device for an unmanned ship [31]. A GPS consists of three parts, including space, control, and a user device. The space part of aGPS consists of 27 GPS satellites (24 active and three standby). The GPS control part consists of one main control station, five detection stations, and three injection stations. The GPS user device part includes a GPS receiver and other devices. The basic principle of a GPS navigation system is to measure the distance between the satellite and the user’s receiver and calculate the receiver’s position by integrating the data of multiple satellites. The GPS signals include a carrier at L1 and L2, Pseudo Random Number (PRN) code at civil code (C/A) and military code (P-code), and navigation data. The GPS signals include raning codes and the navigation message, shown in Figure 4. The GPS system must modulate the ranging code and navigation information onto a carrier frequency before it can be transmitted to the receiver. The frequencies are utilized, including the L1 frequency at 1575.42 MHz and the L2 frequency at 1227.60 MHz. Coarse/Acquisition code (C/A code) is transmitted on the L1 frequency as 1.23 MHz signal. Precision code (P-code) is transmitted on both L1 and L2 frequencies as 10.23 MHz signal.

First of all, before we introduce a GPS attack, we need to understand the GPS working principle. Figure 5 shows how a GPS works. Based on [24], let $D_i$, L, and $L_i$ denote the distance between the i-th satellite and the receiver, the location of the receiver, and the location of the i-th satellite, respectively. $D_i$ is expressed by Euclidean distance as follows:

$$D_i=|L_i-L|,$$

(20)

where $L_i$ = ($x_i,y_i,z_i$) is the coordinate of satellite in Cartesian three-dimensional coordinate system. Similarly, $L=(x,y,z)$ is the coordinate of the receiver. Equation (20) can be transformed into the following Equation (21):

$$D_i=\sqrt{{(x-x_i)}^2+{(y-y_i)}^2+{(z-z_i)}^2}.$$

(21)

The receiver can separate transmission time ($T_i^s$) and location of the i-th satellite ($L_i$) from the received GPS signals. Meanwhile, the receiver can acquire arrival time ($T_r$) when receiving the GPS signal. GPS signal transmission speed (V) is close to the speed of light. $D_i$ can be expressed by $T_i^s$, $T_r$ and V as follows:

$$D_i=(T_r-T_i^s)V,$$

(22)

where $T_i^s$, $T_r$, and V are known scalars. Combining Equations (21) and (22), we can know that the receiver location (L) can be calculated when at least three satellite signals are received. In geometric space, a satellite defines a transmission circle with radius $D_i$. At least three of these circles intersect with the earth’s surface, where the receiver is located

In practice, the time between different satellites is synchronous, but the time of different types of receivers is not exact. We assume that $\delta$ is a clock offset between the receiver and exact GPS time system and $T_u$ is the arrival time of GPS signal measured under a common standard. We can get the following equation:

$$T_u=T_r+\delta ,$$

(23)

$$D_i=(T_r-T_i^s)V+\delta V.$$

(24)

Based on the above, there are four unknown scalars, including $\delta$, x, y, and z. Therefore, the receiver must receive more than four satellites’ signals to calculate the receiver’s exact location.

3.2. GPS Attacks

As we know, the signal structure, spread spectrum code, and modulation method of civilian GPS signals are public. Military GPS signals are encrypted. Therefore, civilian GPS signals are insecure and may be exploited by some attackers. We focus on GPS C/A code in this paper. GPS attacks are classified into jamming attacks and spoofing attacks.

• A jamming attack happens when a GPS jammer transmits strong jamming signals at the same frequency, which suppress the front-end signal of the GPS receiver so that the GPS receiver loses the ability to work or receive attenuated satellite signals. Jamming attacks have the advantages of simple operation and easy implementation. However, the power required for a jamming signal is large;
• A spoofing attack happens when a GPS spoofer transmits the same or similar signal as a GPS signal to guide the GPS receiver to deviate from the original correct navigation and positioning. Spoofing attacks have the advantages of strong concealment.

Next, we introduce GPS jamming and GPS spoofing in detail.

3.2.1. GPS Jamming

The GPS signals of satellites, measured at the surface of the earth, are very weak. According to IDC-GPS-200 [33], the transmitting power of the L1 signal only guarantees the minimum signal power level of −160 dBW on the earth surface and the minimum signal level of −166 dBW when the L2 signal strength reaches the earth surface. The experiment result of Lincoln Laboratory [34] shows that a jammer with a power of 1 W can make the receiver of C/A code within 85 km out of work. If the jamming power is increased by 6 dB, the jamming distance is doubled. Therefore, the GPS is vulnerable to jamming, resulting in difficulties in acquiring navigation data. GSP jamming technologies based on bandwidth ($B_j$) is classified into three types, including Continuous Wave ($B_{cw}$), Narrowband ($B_{nb}$), and Wideband ($B_{wb}$), where $B_{cw}$ < 100 kHz, $1<B_{nb}\le$ 1.023 kHz, $B_{wb}\approx$ 10.23 MHz. The GPS signal acquisition is a search process to determine whether the satellite signals exist or not. Based on [35], the detection probability of GPS signal $P_d$ is proportional to the carrier to noise ratio $C/N_0$. A jammer broadcasts on the same frequency to reduce $C/N_0$, i.e., increasing noise ($N_0$). Therefore, the victim receiver cannot acquire GPS signals normally. A simple GPS jamming system, including a power amplifier, an antenna of a GPS simulator, and an RF signal transmitter, can jam GPS receivers. Many papers have detailed introduction, such as [36,37,38].

3.2.2. GPS Spoofing

Compared with GPS jamming, GPS spoofing is more dangerous to ship navigation because it is surreptitious [32]. An attacker makes the receiver believe that it is at the wrong location. It is a very dangerous situation for the path planning of USV based on APF. GPS spoofing is classified into production spoofing and repeater. GPS production spoofing refers to the receiver-spoofer generating spoofing signal, Pseudo Random Number (PRN), and navigation message, which the victim GPS receiver can receive. GPS repeater spoofing refers to the spoofer modifying, modulating, and amplifying the received GPS signal or sending it out after a delay. The production spoofing for C/A is possible because C/A signals are public and not authenticated, but it is difficult for P-code. Based on [39], we can know the composite signal received at the antenna of a GPS receiver is $S_{ant}$ = $S_a$ + $S_s$ + $S_n$, where $S_a$, $S_s$, and $S_n$ are the authentic signal, spoofing signal, and noise signal, respectively. When $S_s\gg S_a$, the signal received at the antenna of GPS receiver can be approximated by $S_{ant}\approx S_s+S_n$. The spoofing signals generated by the GPS spoofer successfully override the authentic GPS signals. The attacker can transmit its GPS signals using the publicly known GPS parameters by a simple GPS generator. Although this approach can spoof the receiver, the spoof signals look like noise to the receiver [40].

Next, we focus on GPS repeater spoofing. The attacker can delay and modify the content of received GPS signals to spoof the victim GPS receiver into calculating a false location, such as a receiver-spoofer designed by Humphries [41], as shown in Figure 6 and Figure 7. Based on Equation (28) in Section 3.1, if the attacker changes the arrival time of GPS signals ($T_u$) by delaying the transmission of received signals, it will eventually lead to an inaccurate receiver position. On the other hand, if the attacker changes the content of GPS (i.e., transmission time or location of the satellite) according to its intention, the ship which depends on GPS for path planning navigates to the position set by the attacker, causing a greater danger. The paper [40] introduces that the Cornell GRID receiver can simultaneously track 12 C/A channels and generate 8 C/A spoofing channels. Such equipment coupled with the simple RF hardware can implement GPS spoofing. In case of GPS spoofing or signal loss, the speed information obtained by the Inertial Navigation System (INS) is used to assist the GPS receiver tracking loop in implementing navigation and positioning functions. The INS is a technology used to obtain instantaneous velocity and instantaneous position data by measuring acceleration and automatic integration operation, one of the key equipment for ships. When the GPS is combined with the INS, it can still complete the output of position and speed in the face of GPS jamming. However, in the face of GPS spoofing, it will lead to the divergence of the GPS/INS navigation system and destroy the overall performance of the integrated navigation system. The integrated navigation system supervises the GPS during unmanned ships’ navigation. When there is a difference between the position information calculated from the GPS and the position information estimated from INS according to the previous time, the integrated system will suspect that the GPS signal has been spoofed. Therefore, in GPS spoofing, it is necessary to gradually induce the unmanned ships to deviate from the course step by step. Lidar and navigation radar are the main means of ship obstacle avoidance detection. Similarly, GPS spoofing will affect the path planning after multi-source data fusion from lidar, radar, and sensors.

3.2.3. Designing a GPS Attack

We design a GPS spoofing attack on a single GPS receiver, which can be seen in Figure 8. We assume that the attacker uses a GPS spoofer to attack a victim’s GPS receiver. $P=(x,y,z)$, $P^A$, and ${\delta }^A$ are the physical location of the receiver, the physical location of the attacker, and the transmission time offset of the attacker, respectively. From the attackers’ perspective, the expected pseudo-range ($R^A$) that the receiver in location P calculates based on the attacker’s signals is as follows.

$$R^A=|P-P^A|+{\delta }^{A}V.$$

(25)

In the perspective of the receivers, the pseudo-range (R${}^{\prime }$) is calculated according to the signals of impersonated satellite location (L${}^{\prime }$), the time offset (${\delta }^{\prime }$), and receivers location determined by an attacker (L) as follows.

$$R^{\prime }=|L^{\prime }-L|+{\delta }^{\prime }V.$$

(26)

At the same time, the pseudo-range (R${}^{\prime }$) can be calculated by transmission (T${}_s$) and the receiving time (T${}_r$) of GPS spoofing signals as follows.

$$R^{\prime }=(T_r-T_s)V+{\delta }^{\prime }V=|L^{\prime }-L|+{\delta }^{\prime }V.$$

(27)

If the attacker (A) wants to spoof the GPS receiver (G) successfully, this requires R${}^A$ = R${}^{\prime }$.

$$|P-P^A| + {\delta }^{A}V=|L-L^{\prime }|+{\delta }^{\prime }V.$$

(28)

In the term of the attack on GPS C/A, the attacker can set the location of satellite $L_s$ = ($x_s$, $y_s$, $z_s$) and the physical location of the attacker $P_0$ = ($x_0$, $y_0$, $z_0$) in advance. The attacker brings $L^{\prime }$ = $L_s$ and $P^A$ = $P_0$ into Equation (32) to solve for ${\delta }^{\prime }$, and $\delta$ = ${\delta }^{\prime }$.

3.3. Spoofing Analysis

Next, we analyze how the above GPS spoofing influences the result of the path planning of unmanned ships based on the APF method in Section 2. As we see in the above subsections, GPS signals received by the GPS receiver of an unmanned ship is determined by the attacker, conducting a GPS spoofing attack on the unmanned ship. We take an obstacle as an example to explain the influence of GPS deception on the path planning results of the APF method. Let $X=(x,y)$ denote the physical position of the unmanned ship, $X_1=(x_1,y_1)$ denote the obstacle coordinates, $X_g=(x_g,y_g)$ denote the goal coordinate, $\xi$ denote the positive scaling factor for attractive potential, and $\eta$ denote the positive scaling factor for repulsive potential. The GPS receiver of the unmanned ship receives the GPS data of the ship, i.e., $X^{\prime }$= X + $\delta$ = (x + ${\delta }_x$, y + ${\delta }_y$). Additionally, $\delta$ is the position offset added by attackers during GPS spoofing. In conclusion, the Equations (2)–(10) of the artificial potential field method in Section 2 is changed into the following Equations (29)–(34). In the case of GPS spoofing, the attractive potential field $U_{att}$(X${}^{\prime }$) is rewritten as:

$$U_{att}\left(X^{\prime }\right)={\displaystyle \frac{1}{2}}\xi {(X+\delta -X_g)}^2,$$

(29)

$$U_{att}\left(X^{\prime }\right)={\displaystyle \frac{1}{2}}\xi \left[{(x+{\delta }_x-x_g)}^2+{(y+{\delta }_y-y_g)}^2\right].$$

(30)

Next, we analyze the change of the repulsive potential field in the case of GPS spoofing. When the distance between the OS and the obstacle is less than or equal to the influence radius (${\rho }_0$) of the repulsion force generated by the obstacle, the repulsive potential field of the obstacle can be written as:

$$U_{re{p}_1}\left(X^{\prime }\right)={\displaystyle \frac{1}{2}}\eta {\left({\displaystyle \frac{1}{\sqrt{{(x+{\delta }_x-x_1)}^2+{(y+{\delta }_y-y_1)}^2}}}-{\displaystyle \frac{1}{{\rho }_0}}\right)}^2.$$

(31)

When the distance between the OS and the obstacle exceeds the radius of influence (${\rho }_0$) of the repulsion force generated by the obstacle, we think that the repulsive potential field of the obstacle is 0. We superimpose attractive potential field and repulsive potential field to form artificial potential field $U\left(X^{\prime }\right)$, and the equation is shown as follows.

$$U\left(X^{\prime }\right)=U_{att}\left(X^{\prime }\right)+U_{re{p}_1}\left(X^{\prime }\right).$$

(32)

As we know, the path planning of the artificial potential field method is to move forward along the negative gradient direction from the current position until the gradient is 0. The derivatives of the attractive potential function and repulsive potential function are attractive force function and repulsive force function, which can be written as:

$$F_{att}\left(X^{\prime }\right)=-\nabla U_{att}\left(X^{\prime }\right),$$

(33)

$$F_{re{p}_1}\left(X^{\prime }\right)=-\nabla U_{re{p}_1}\left(X^{\prime }\right).$$

(34)

According to Equation (34), assuming that x and y are from 0 to 10, the step is 0.1, $\delta$ is from 0 to 10, the step is 0.1, the coordinate of goal $X_g$ = (10, 10), the coordinate of obstacle $X_{o1}$ = (4, 8), the attraction gain $\xi$ = 50, the repulsive gain $\eta$ = 15, and the influence distance of obstacles ${\rho }_0$ = 0.4, we can get the curve of the influence of $\delta$ change rate on $U_{att}$, as shown in Figure 9. Similarly, according to Equation (35), the curve of delta change rate on $U_{re{p}_1}$ can be obtained, as shown in Figure 10. The influence of $\delta$ change rate on the resultant force of attraction and repulsion is shown in Figure 11.

4. Experiments

To verify the feasibility and practical effect of GPS spoofing on the APF method in the previous section, we first use HackRF ONE as a GPS spoofer to simulate GPS spoofing, as shown in Figure 12. Then we use GPS spoofing data to simulate the path planning of the APF method. The hardware system of the GPS spoofing test includes HackRF ONE, GPS external clock, and a 700–2700 Mhz antenna, as shown in Figure 13. The software platform is Ubuntu 64 bit (18.04), and the GPS receiving terminal is Xiaomi 6 mobile phone, as shown in

Table 1. Experimental environment of GPS spoofing.

Item	Value
Hardware	HackRF ONE
Operation System	Ubantu 64 bit
Network	China Mobile LTE, China Unicom LTE
Antenna	700–2700 MHZ
Clock	GPS external clock
GPS Receiver	Xiaomi 6 mobile phone
Test App	GPS Test Plus 1.5.3

. We use Matlab to simulate the path planning of the APF method to test the influence of GPS spoofing on path planning.

4.1. GPS Spoofing Simulation

We use GPS-SDR-SIM as a GPS signal generator code, which can produce spoofing GPS signals. GPS-SDR-SIM is an open-source GPS generator project. To make it easier for readers to understand GPS spoofing, we introduce the process of GPS spoofing step by step. We download and compile the GPS simulator code from GitHub, as shown in Figure 14. Then, we can generate GPS longitude and latitude information that we want to spoof through online tools and generate GPS simulation data through GPS simulator according to this longitude and latitude information, as shown in Figure 15. Among them, 31.60321167 and 120.4666667 are the GPS longitude and latitude of spoofing to be transmitted to the GPS receiver. After the execution of the above command, the gpssim.bin file is generated, which saves the GPS spoofing data generated by the simulation code, as shown in Figure 16. The GPS test app for mobile phones is GPS Test Plus. Before starting the GPS spoofing attack, open the app of GPS Test Plus and check the physical position of the mobile phone, as shown in Figure 17.

We connect HackRF ONE to the computer with USB and test whether the host installation is successful in the shell terminal of Ubuntu, as shown in Figure 18, which proves that the hardware system of HackRF ONE has been successfully connected to the computer. HackRF ONE is a full open-source hardware and software project that can provide Software Defined Radio (SDR) solutions. The wireless communication protocol based on software definition can replace the hardware connection so that the frequency band, air interface protocol, and function can be upgraded through software download and update without replacing the hardware. We use HackRF ONE to transmit the fake GPS data we simulated above, as shown in Figure 19. After waiting for 3–4 min, we open the app of GPS Test Plus and find that the mobile phone position has been changed to a fake GPS spoofing position, as shown in Figure 20.

4.2. APF Simulation

We use Matlab to simulate the path planning of the unmanned ship using the APF method, as shown in Figure 21. The algorithm needs to set the start position, goal position, obstacle position, gravity and repulsion gain coefficient, obstacle influence distance, step, and iteration times.

The purpose of a GPS spoofing attack based on the APF method is to cause lateral deviation in the position of the ship’s navigation trajectory so that the ship deviates from the original path planning, as shown in Figure 22.

We take a practical example to illustrate the harm of GPS spoofing to unmanned ships using the APF method for path planning. Without the repulsive force of obstacles, we assume that the physical location of OS $x=(0,0)$, the false location of OS $x^{\prime }=(2,0)$, the goal location $x_g=(5,5)$, and the step is 1, shown as in Figure 23. Without GPS spoofing, the next position of OS based on APF is $x_1=(\frac{1}{\sqrt{2}},\frac{1}{\sqrt{2}})$. Under GPS spoofing, the next position of OS based on APF is ${x_1}^{\prime }=(\frac{3}{\sqrt{3}4},\frac{5}{\sqrt{3}4})$. In conclusion, GPS spoofing can cause the yaw of unmanned ships using the APF method for path planning.

In the environment of both attraction of goal and repulsion of an obstacle, the attacker can influence the result of path planning based on the APF method through GPS spoofing. We use a practical example to illustrate the influence of GPS spoofing on path planning results by the APF method. In the Cartesian coordinates, we assume that $x_g$ = (10, 10) is position of the goal, x = (0, 0) is the initial position of OS, $x_{o_1}=(4,8)$ and $x_{o_2}=({\displaystyle \frac{1}{5}},-{\displaystyle \frac{1}{5}})$ are the positions of the first obstacle and the second obstacle, respectively. $k=50$ and $m=15$ are the attraction gain and the repulsive gain, respectively, $l=0.2$ is the step length of OS. ${\rho }_0=0.5$ is the influence distance of obstacles. When the distance between the obstacles and OS is greater than this distance ${\rho }_0$, the repulsion force is 0. ${\theta }_0$ is the angle between the line from the position of OS (x) to the goal ($x_g$) and the x-axis, ${\theta }_1$ is the angle between the line from the position of OS to the first obstacle ($x_{o_1}$) and the x-axis, ${\theta }_2$ is the angle between the line from the position of OS to the second obstacle ($x_{o_2}$) and the x-axis. First of all, we calculate the values of ${\theta }_0$, ${\theta }_1$, and ${\theta }_2$ according to the following formulas.

$${\theta }_0=arccos\left({\displaystyle \frac{10-0}{\sqrt{{(10-0)}^2+{(10-0)}^2}}}\right)=arccos\left({\displaystyle \frac{\sqrt{2}}{2}}\right),$$

$${\theta }_1=arccos\left({\displaystyle \frac{4-0}{\sqrt{{(4-0)}^2+{(8-0)}^2}}}\right)=arccos\left({\displaystyle \frac{\sqrt{5}}{5}}\right),$$

$${\theta }_2=arccos\left({\displaystyle \frac{{\displaystyle \frac{1}{5}}-0}{\sqrt{{({\displaystyle \frac{1}{5}}-0)}^2+{(-{\displaystyle \frac{1}{5}}-0)}^2}}}\right)=arccos\left({\displaystyle \frac{\sqrt{2}}{2}}\right).$$

We assume that $F_{at{t}_x}$ and $F_{at{t}_y}$ are the components of the attraction of the goal on the OS in the x and y directions. We calculate the x and y-axis components of the attraction of goal on the OS as follows.

$$F_{at{t}_x}=k\sqrt{{(10-0)}^2+{(10-0)}^2}cos\left({\theta }_0\right)=500$$

$$F_{at{t}_y}=k\sqrt{{(10-0)}^2+{(10-0)}^2}sin\left({\theta }_0\right)=500$$

$F_{re{p}_1}$ and $F_{re{p}_2}$ are the repulsive forces of the first and second obstacles for the OS, respectively. $F_{re{p}_{x1}}$, $F_{re{p}_{y1}}$, $F_{re{p}_{x2}}$ and $F_{re{p}_{y2}}$ are the components of the repulsive force on the x and y axes, respectively. $F_{sumx}$ and $F_{sumy}$ are the resultant forces in the x and y directions, respectively. ${\theta }_{sum}$ is the angle between the resultant force and the x-axis. Since the distance between OS and the first obstacle is greater than ${\rho }_0$, the repulsive force of the obstacle on the OS is 0. We calculate the repulsive forces of the second obstacle on the OS as follows.

$$F_{re{p}_1}=0,$$

$$F_{re{p}_2}=m\left({\displaystyle \frac{1}{\sqrt{{({\displaystyle \frac{1}{5}}-0)}^2+{(-{\displaystyle \frac{1}{5}}-0)}^2}}}-{\displaystyle \frac{1}{{\rho }_0}}\right)=45.$$

We calculate the components of the repulsive force of the obstacles on the OS in the x and y directions as follows.

$$F_{re{p}_{x1}}=0,$$

$$F_{re{p}_{y1}}=0,$$

$$F_{re{p}_{x2}}=F_{re{p}_2}cos\left({\theta }_2\right)=32,$$

$$F_{re{p}_{y2}}=F_{re{p}_2}sin\left({\theta }_2\right)=32.$$

The resultant forces in the x and y directions are as follows.

$$F_{sumx}=F_{at{t}_x}+F_{re{p}_{x1}}+F_{re{p}_{x2}}=532,$$

$$F_{sumy}=F_{at{t}_y}+F_{re{p}_{y1}}+F_{re{p}_{y2}}=532,$$

$${\theta }_{sum}=arctan\left({\displaystyle \frac{F_{sumy}}{F_{sumx}}}\right)=0.785.$$

We calculate the next position $p_{next}$ ($p_{nextx}$, $p_{nexty}$) in the path planning of OS as follows.

$$p_{nextx}=0+lcos\left({\theta }_{sum}\right)=0.14,$$

$$p_{nexty}=0+lsin\left({\theta }_{sum}\right)=0.14.$$

According to the above formulas, if the position of OS is $X=(0,0)$, the next position of OS calculated by the APF algorithm is $p_{next}=(0.14,0.14)$. If the attackers change the position of OS by the GPS spoofing, we find that the next position of path planning results of OS will be changed, shown in

Table 2. Data relationship between false positions and next positions of OS.

False Position x	False Position y	Next Position x	Next Position y	x Offset	y Offset
0.1	0	0.1385	0.1443	0.0015	0.0043
0.2	0	0.1337	0.1487	0.0063	0.0087
0.3	0	0.1320	0.1503	0.0080	0.0103
0.4	0	0.1336	0.1488	0.0064	0.0088
0.5	0	0.1353	0.1473	0.0047	0.0073
0.6	0	0.1363	0.1464	0.0037	0.0064
0.7	0	0.1366	0.1461	0.0034	0.0061
0.8	0	0.1366	0.1460	0.0034	0.0060
0.9	0	0.1364	0.1462	0.0036	0.0062
1	0	0.1361	0.1466	0.0039	0.0066
0	0.1	0.1417	0.1412	0.0017	0.0012
0	0.2	0.1426	0.1402	0.0026	0.0002
0	0.3	0.1437	0.1391	0.0037	0.0009
0	0.4	0.1449	0.1379	0.0049	0.0021
0	0.5	0.1460	0.1367	0.0060	0.0033
0	0.6	0.1470	0.1356	0.0070	0.0044
0	0.7	0.1480	0.1345	0.0080	0.0055
0	0.8	0.1490	0.1334	0.0090	0.0066
0	0.9	0.1499	0.1323	0.0099	0.0077
1	0	0.1361	0.1466	0.0039	0.0066
2	0	0.1293	0.1526	0.0107	0.0126
3	0	0.1202	0.1599	0.0198	0.0199
4	0	0.1094	0.1674	0.0306	0.0274
5	0	0.0970	0.1749	0.0430	0.0349
6	0	0.0829	0.1820	0.0571	0.0420
7	0	0.0671	0.1884	0.0729	0.0484
8	0	0.0497	0.1937	0.0903	0.0537
9	0	0.0310	0.1976	0.1090	0.0576
10	0	0.0114	0.1997	0.1286	0.0597

. By analyzing these data, we can see that the farther the false position is from the physical position, the greater the coordinate change of the next position of OS. To prevent GPS spoofing from being found, the false position needs to be as close to the physical location of OS as possible and changes continuously with time.

5. Conclusions

At present, the research on path planning of unmanned ships assumes that the data from GPS receivers are reliable. However, the security and authenticity of the data collected by the front end of the unmanned ship are very important. Once the path planning algorithm uses inaccurate or even false data, it will lead to ship collision, grounding, or deviation from the course, causing serious economic losses and causing great security risks to other sailing ships. This paper designs a method where attackers transmit the fake position of ships through GPS spoofing to influence path planning based on APF. Experiments have studied and verified the feasibility of using a simple and economical GPS spoofing device to implement GPS spoofing. The experiments in this paper show that GPS spoofing for path planning of unmanned ships based on the artificial potential field algorithms is feasible without the interference of other factors. Finally, attackers make unmanned ships deviate from the target point through GPS spoofing.

This paper mainly focuses on the impacts of GPS spoofing on the path planning of unmanned ships. At present, there are few papers on the impacts of GPS spoofing on the path planning of unmanned ships. Moreover, there are no large-scale practical application examples of unmanned ships. Limited by the experimental environment and conditions, we cannot test the impacts of GPS spoofing on real unmanned ships since modifying the GPS signal for such ships is very dangerous. We could not get permission to conduct such an experiment even through our organization’s own ships. According to the GPS spoofing steps proposed in this paper, we test the GPS transmitting and receiving devices through experiments. It can be verified that the GPS spoofing method in this paper can also be implemented on real unmanned ships.

Unmanned ships have great advantages in economy, safety, and society, including reducing the operation cost of the ship owner, reducing the cost of personnel on board, reducing the loss caused by human error risk, and reducing the threat of pirates to the personal safety of the crew. In the future, unmanned ships will play an important role in maritime cargo transportation and the military field. There are many sensors and electronic devices on the unmanned ship to collect the dynamic data of navigation and environment, which need to be transmitted to the shore-based control center through communication networks. There may be data delay and packet loss in network transmission, which will affect the real-time monitoring and remote control of the shore-based control center. Moreover, many sensors and electronic devices with open communication protocols, unified standards, and a lack of effective security protection are deployed on unmanned ships, which will bring more potential network attacks and increase the possibility of network attacks on unmanned ship systems. Once an unmanned ship is attacked by the network or the network security management is improper, the shipowners, port operators, and their insurance companies will face a great risk of loss, such as ship collision, grounding, or deviation from the course, which will not only cause serious economic losses but also cause security risks to other ships. Therefore, the network security of unmanned ships is very important for the development of unmanned ships. Finding these security vulnerabilities and problems can be targeted to study the corresponding detection and defense strategies to minimize the loss. Additionally, we will consider inertial navigation systems and means of monitoring and measuring the distance to obstacles as our future work.